3.0 Conclusions 3.1 Findings as to Causes and Contributing Factors The aircraft took off from Varadero with a pre-existing disbond or an in-plane core fracture damage to the rudder, caused by either a discrete event, but not a blunt impact, or a weak bond at the z-section of the left side panel. This damage deteriorated in flight, ultimately resulting in the loss of the rudder. The manufacturer's recommended inspection program for the aircraft was not adequate to detect all rudder defects; the damage may have been present for many flights before the occurrence flight. This model of rudder does not include any design features in the sandwich panels to mechanically arrest the growth of disbond damage or in-plane core failure before the damaged area reaches critical size (such a feature was not specifically demanded for certification). 3.2 Findings as to Risk A cockpit voice recorder with a 30-minute recording capacity was installed on the aircraft, and its length was insufficient to capture the rudder-loss event, resulting in critical information concerning the rudder failure not being available to investigators. There was no published procedure for disabling the recorders once the aircraft was on the ground; valuable investigation information can be lost if the data are not preserved. The sampling intervals for lateral and longitudinal acceleration captured by the digital flight data recorder were insufficient to record the highly dynamic conditions present at the time of the occurrence. This resulted in incomplete information being recorded. The rudder position filtering and the necessity for additional analysis adversely affected the accuracy and effectiveness of the investigation efforts. There are insufficient published procedures available to flight crew members to assist in recovering from a Dutch roll. Declaring an emergency and clearly communicating the nature of the problem allows air traffic control to more easily coordinate between units and anticipate the needs of the crew in planning traffic management. Procedures and practices that do not facilitate information sharing between crew members increase the likelihood that decisions will be based on incomplete or inaccurate information, potentially placing passengers and crew at risk. 3.3 Other Findings Throughout the event, the crew received no electronic centralized aircraft monitor message relating to the control problem that the aircraft had experienced, and there were no other warning lights or cockpit indications of an aircraft malfunction. After the rudder-separation event, the aircraft was not in danger of losing the vertical tail plane during the flight, either through loss of static strength or loss of stiffness. 4.0 Safety Action 4.1 Action Taken 4.1.1 Transportation Safety Board of Canada 4.1.1.1TSB Recommendations-Airbus Composite Rudder Inspection Program The separation of the rudder from Air Transat Flight961 and the damage found during the post-occurrence fleet inspections suggest that the current inspection program for Airbus composite rudders may not be adequate to provide for the timely detection of defects. In addition, preliminary tests demonstrating that disbonds can grow due to altitude-related pressure differential suggest that increased attention is warranted to mitigate the risk of additional rudder structural failures. The consequences of a rudder separation include reduced directional control and possible separation of the vertical tail plane (VTP). Therefore, on 27 March 2006, the Board recommended that: The Department of Transport, in coordination with other involved regulatory authorities and industry, urgently develop and implement an inspection program that will allow early and consistent detection of damage to the rudder assembly of aircraft equipped with part number A55471500 series rudders. (A06-05, issued March2006) On 14 June 2006, Transport Canada (TC) responded to Board Recommendation A06-05. TC concurs with the TSB suggestion that the current A310-300 inspection program may not be adequate to provide timely detection of defects to the rudder assembly. Specifically, TC has indicated that the following corrective actions will be taken: A letter will be sent to Airbus and the Direction Gnrale de l'Aviation Civile (DGAC) of France detailing the results of additional inspection on a Canadian-registered A310-300 series aircraft. TC will recommend that a detailed inspection of the drainage path of the rudder for blockage be added to the current inspection program to ensure that there is adequate drainage. TC will request that Airbus review the current inspection program for the vertical stabilizer and rudder assembly for the A300/A310 aircraft series. A tap test is potentially not effective in determining small areas of delamination or disbond of composite materials; therefore, TC is working with the National Research Council of Canada to identify more suitable inspection techniques to detect failures in composite materials. To better identify failures in composite material, TC will coordinate with the International Maintenance Review Board to review the logic used in developing maintenance programs. The TSB has reviewed TC's response and assessed it as Satisfactory Intent. Further, on 27 March 2006, the Board recommended that: The European Aviation Safety Agency, in coordination with other involved regulatory authorities and industry, urgently develop and implement an inspection program that will allow early and consistent detection of damage to the rudder assembly of aircraft equipped with part number A55471500 series rudders. (A06-06, issued March2006) On 22 November 2006, the European Aviation Safety Agency (EASA) stated that it agreed with Board Recommendation A06-06 and that Airworthiness Directive 2006-0066 issued on 24March2006 requiring a mandatory one-time inspection satisfactorily addressed the Board recommendation. Although the EASA agreed with the Board recommendation, Airworthiness Directive 2006-0066 referenced in its 22November2006 response does not provide for a repetitive inspection cycle that will allow early and consistent detection of damage, as is implied in the core of Recommendation A06-06. Nevertheless, the TSB assessed that the EASA is well positioned to take a leadership role within the industry in advocating for the development and integration of an inspection program dealing with composite materials. On that basis, a conference call was initiated on 20December2006. Following the conference call, the EASA released a further response dated 17January2007. This response stated that all elements that may have potentially caused the damage growth were still being investigated. Furthermore, the EASA stated that, within the Continued Airworthiness process and in cooperation with Airbus, it continues its efforts to determine the most appropriate corrective actions. Subsequently, the EASA will consider mandating those actions, including amending the maintenance program to require repetitive inspections. The 17 January 2007 response reflects EASA's commitment to continue to develop corrective actions that may include amending the maintenance program to require repetitive checks. Because EASA's most recent response contains a proposed action that, if implemented, will reduce or eliminate the risks associated with this deficiency, the response to Recommendation A06-06 is assessed as Satisfactory Intent. 4.1.1.2TSB Safety Advisory-Cockpit Voice Recorder Duration The cockpit voice recorder (CVR) installed on Air Transat Flight961 employed a continuous-loop magnetic tape of 30-minute duration. The event of the rudder separation on the Air Transat Flight961 CVR was recorded approximately 60minutes before landing. Crew conversations and cockpit sounds before the event of the CVR recording may have provided substantial insight into any initiating or precursor events that led to the accident. Given the need for longer periods of recorded sound to capture the initiating events of aviation accidents and the availability of two-hour CVRs, the Board believes that such recorders should be mandated by regulatory authorities worldwide. Consequently, the TSB issued, on 03 March 2006, a Safety Advisory to TC re-addressing its concern that, in2005, there are still commercial aircraft not equipped with a CVR with at least two-hour recording capacity. 4.1.1.3TSB Safety Advisory-Digital Flight Data Recorder Recording of Filtered Data With filtering, the ability to differentiate between a rudder excursion and a data filtering artefact is limited. The filtering of raw sensor data necessitated additional analysis to estimate the probable rudder position history, ultimately affecting the accuracy and timeliness of the investigation efforts. The Canadian Aviation Regulations (CARs) do not address the requirement to test parameter accuracy under both static and dynamic conditions as does 14CFR (Code of Federal Regulations) of the United States. The CARs continue to refer to the previous minimum operational performance specifications (MOPS) for flight recorders (ED55), rather than the current ED112, which offers guidelines on data filtering. The current Federal Aviation Administration (FAA) Notice of Proposed Rule Making (issued 28February2005) regarding revision of digital flight data recorder (DFDR) regulations does not address the recurring problem of filtered data. Consequently, the TSB issued, on 03March2006, a Safety Advisory to TC addressing its concern that data filtering may prevent investigators from determining accurate control surface positions from recorded data, particularly under dynamic conditions. 4.1.1.4TSB Safety Advisory-Digital Flight Data Recorder Low Recording Rates The Air Transat occurrence demonstrated that further improvements to DFDRs are needed to more effectively determine the sequence of events in an accurate and timely manner. Specifically, due to the low recording rates for acceleration data, the existence of aeroelastic effects as a possible failure mode could not be positively identified. The limited lateral acceleration data also prevented the characterization of the initiating event. Consequently, the TSB issued, on 08March2006, a Safety Advisory to TC addressing the possible conduct of a review of recording rates of DFDR data to ensure that adequate information is made available to analyze dynamic flight events. 4.1.1.5TSB Safety Advisory-Dutch Roll Recovery Procedure For this loss of rudder occurrence, the absence of sufficient guidance in Dutch roll recovery resulted in a situation wherein the crew engaged the autopilot, which led to a worsening of the flight characteristics. Although the engagement of the autopilot did not increase the severity of consequences for this occurrence, under other circumstances, such action might have led to an aircraft upset. Consequently, the TSB issued, on 08 March 2006, a Safety Advisory to TC suggesting that TC, in concert with industry, FAA, DGAC, and EASA, may wish to conduct a review of the adequacy of published procedures to ensure that pilots have the required knowledge to safely recover from a Dutch roll situation. 4.1.2 National Transportation Safety Board As a result of its investigation into an Airbus A300-600 aircraft operated by FedEx Express that was damaged during routine maintenance on 27 November 2005, the National Transportation Safety Board (NTSB) recommended on 24March2006 that the FAA Require that all operators of Airbus A-300 series airplanes immediately [possibly before further flight] comply with four Airbus All Operators Telexes (AOT) A300-55A6042, A310-55A2043, A330-55A3036, and A340-55A403 dated March2,2006. Any disbonding to the rudder skins that occurs in the presence of hydraulic fluid contamination should be repaired or the rudder should be replaced as soon as possible, well before the 2,500flights specified in the AOTs. (A-06-27, issued March2006) The NTSB further recommended that the FAA Establish a repetitive inspection interval for Airbus premodification 8827rudders until a terminating action is developed. The interval should be well below 2,500flights. (A-06-28, issued March2006) 4.1.3Bureau d'Enqutes et d'Analyses pour la Scurit de l'Aviation Civile On 10 March 2006, the Bureau d'Enqutes et d'Analyses pour la Scurit de l'Aviation Civile recommended that [translation] the EASA impose as soon as possible an appropriate inspection program for the concerned rudders (part numberA55471500). (000153/BEA/D, issued March2006) 4.1.4 Airbus 4.1.4.1 All Operators Telex (AOT-1) Based on the initial information uncovered during this TSB investigation, Airbus, on 17March2005, issued an AOT for the inspection of all aircraft equipped with part number A55471500 series rudders. This one-time visual and tap-test inspection involved 222Airbus A310s, 146Airbus A300-600s, 6Airbus A330s, and 34Airbus A340s, for a total of 408aircraft. In addition, a more detailed inspection of rudder side panels on over 20aircraft was conducted using the elasticity laminate checker (ELCH) test method. Finally, the attention drawn to rudders by the occurrence resulted in operators examining their rudders more closely during maintenance. These various inspections found examples of disbonds, damage around hoisting points and trailing edge fasteners of the rudder, corrosion and abrasion at hinges, seized hinges, hinges with excessive free play, and water ingress. 4.1.4.2 All Operators Telex (AOT-2) Transportation Safety Board of Canada - AVIATION REPORTS - 2005 - A05F0047 Transportation Safety Board of Canada Common menu bar links Fran�ais Home Contact Us Help Search canada.gc.ca REPORTS AVIATION 2005 A05F0047 Institutional links Main Links TSB Home Proactive Disclosure Marine Pipeline Rail Air Air Investigation Reports Recommendations and Assessments of Responses Board Concerns Air Statistics Reporting an Air Occurrence Air Investigation Reports Recommendations and Assessments of Responses Board Concerns Air Statistics Reporting an Air Occurrence AVIATION REPORTS - 2005 - A05F0047 1.0 Factual Information 1.1 History of the Flight The pre-flight inspection was carried out by the captain before departure from Varadero; no damage was observed on the rudder. The inspection was conducted at night, the logo light was on, and the pilot was using a flashlight. However, it was difficult to see the entire rudder, especially the bottom part, which is partially concealed by the elevators. To see the bottom part, the pilot has to step back from the aircraft, thus reducing the acuity of the observation. The crew engaged autopilot system No.2 on departure from Varadero. The flight progressed normally until the aircraft reached flight level (FL)1350, its assigned altitude. At approximately 0702Coordinated Universal Time (UTC),2 the flight crew heard a loud bang immediately followed by several seconds of vibration. Cabin crew members located in the back of the aircraft were thrown to the floor and unsecured galley carts moved freely. The aircraft started to Dutch roll,3 and the captain took control and disconnected the autopilot. The aircraft was difficult to control in the lateral axis. In an attempt to better manage the cockpit workload, the other autopilot system (No.1) was engaged. As the Dutch roll movement started to intensify, autopilot No. 1 was disengaged and the aircraft was hand-flown. During these actions, the aircraft climbed to about FL359. The flight crew requested a descent and informed air traffic control (ATC) that they had experienced an autopilot problem and had reverted to flying manually. While descending, the crew cycled through the electronic centralized aircraft monitor (ECAM) system pages in an attempt to diagnose the problem. Throughout the event, there was no ECAM message relating to the control problem that the aircraft had experienced, and there were no warning lights or cockpit indications of an aircraft malfunction. Even with limited clues as to the cause of the Dutch roll, the crew knew that descending to a lower altitude might lessen or stop the Dutch roll motion. Initial indications led to the possibility of the loss of both yaw dampers (YD) but both YD switches were engaged. Had a dual YDfailure occurred, the flight warning computer would have triggered appropriate warnings and messages, and the autopilot would have disconnected. The Dutch roll gradually decreased in the descent and ceased when the aircraft passed FL280. The crew continued the descent to 10000feet above sea level (asl) in preparation for a landing in Fort Lauderdale. The captain returned control of the aircraft to the first officer and called the flight director (FD)to provide the standard briefing to the cabin crew for emergency or abnormal situations. The crew contacted company dispatch to discuss the situation and elected to return to Varadero, where the company was better equipped to deal with the aircraft and the passengers. At 0739, the flight was cleared to Varadero at FL190. During the climb to FL190, the crew engaged autopilot No.1 and disengaged it during the final portion of the visual approach to Runway06 at Varadero. During the landing flare, nose wheel steering was used for directional control on the runway. An uneventful landing was completed at 0819. The crew conducted a flight control check after landing and the ECAM indicated that everything was normal. The aircraft was taxied to the gate where the passengers were deplaned normally through the main door. After shutdown, a visual inspection revealed that the aircraft rudder had broken and most of it was missing. 1.2 Injuries to Persons 1.3 Damage to the Aircraft The rudder was substantially damaged (see Photo1), and the rear attachment fittings of the vertical tail plane (VTP) were delaminated locally. There was minor damage to the tail cone. Photo1.Right-side view of vertical tail plane and rudder residuals 1.4 Personnel Information 1.4.1 Captain Information The captain held a Canadian airline transport pilot licence (ATPL) - aeroplane, endorsed for single- and multi-engine land aeroplanes, with type ratings on Boeing727, Boeing737, Boeing757, Convair580, AirbusA310, Fokker100, and Lockheed1011 aircraft. His licence was endorsed with a Group1 instrument rating valid until 01September2005. The captain started working for the company as a captain on the Boeing757 on 18March1996. In 1997, he qualified as captain on the Boeing 737-400 and flew it for about six months before returning as captain on the Boeing757. In2003, he began his conversion to the A310,and under the supervision of an Air Transat instructor, completed the A310 computer-based ground school. The flight simulator portion of the initial A310training was conducted by Air Transat instructors at a training centre in Miami, Florida, from 12to 27August2003. All training was in accordance with the company A310training program. The captain passed his initial pilot proficiency check (PPC) as an A310captain on 27August2003, and his last line check was performed on 17September2004. His last PPCwas performed on 14December2004. Company training records indicate that he had successfully completed all required recurrent training. 1.4.2 First Officer Information The first officer held a commercial pilot licence - aeroplane, endorsed for single-and multi-engine land aeroplanes, with type ratings on Convair580, AirbusA310, and Lockheed1011 aircraft. His licence was endorsed with a Group1 instrument rating valid until 01December2005. The first officer started working for the company on 15February1988 as a flight engineer on the Lockheed1011 aircraft, accumulating 8500hours of flight time. He was qualified as first officer on the Lockheed1011 on 18June2002. In2004, he began conversion to theA310. Under the supervision of an Air Transat instructor, he completed the A310computer-based training. The flight simulator portion of the initial A310training was conducted by Air Transat instructors at a training centre in Montral, Quebec, from 25May to 15June2004. All training was in accordance with the company A310training program. The first officer passed his initial PPCas an A310first officer on 15June2004, and his last line check was performed on 07July2004. His last PPC was performed on 08October2004. Company training records indicate that he had successfully completed all required recurrent training. 1.4.3 Flight Attendants The cabin crew comprised seven flight attendants (FAs), including a flight director (FD)and an assistant flight director (AFD), all of whom had 10to 16years of service. They were qualified and trained in accordance with the requirements of Transport Canada and AirTransat. 1.5 Aircraft Information 1.5.1 General Information The occurrence aircraft was an AirbusA310-308, manufacturer's serial number (MSN)597. Transport Canada issued the certificate of registration on 16 May 2001 and the certificate of airworthiness on 16June2001, both valid at the time of the occurrence. 1.5.2 Aircraft History The occurrence aircraft had its first flight in September1991 and was delivered to a Middle Eastern airline in August1992, where it remained until acquired by Air Transat in May2001. At the time of the occurrence, the aircraft had accumulated 49224flight hours and 13444flight cycles. By comparison, the flight hour and flight cycle fleet leader aircraft for this aircraft type had accumulated 75675hours and 34384cycles respectively. 1.5.3 Vertical Tail Plane Design Figure1.Schematic of the vertical tail plane The VTP consists of a spar box, leading edge fairing, trailing edge panels, and tip (see Figure1). The spar box consists of left and right side panels each composed of solid carbon fibre-reinforced plastic (CFRP) laminate skin and interior stiffeners. At the bottom of each side panel, there are three large integrally constructed CFRP lugs, known as the main attachment fittings, which attach to the fuselage. At the front and rear of the box, there are solid CFRP laminate spars running the length of the VTP, joining the left and right skin panels, forming the front and rear faces of the spar box. In the centre of the box, there is a shorter solid CFRP laminate spar, which extends only up to rib5. At the bottom of each of these three spars are two integrally constructed lugs, known as transverse load fittings, which attach to the fuselage. Within the box, there are a total of 18solid CFRPlaminate ribs, including closing ribs at the bottom and top. The leading edge and the tip are constructed of sandwich composite. Attached to each side of the rear spar, and extending aft, there is a flat trailing edge panel that acts as an aerodynamic fairing to fill the gap between the rear spar of the VTPand the leading edge of the rudder. There are seven hinge positions along the VTP rear spar for the attachment of the rudder. These are numbered1 through7, from bottom to top. Figure2 shows the design details at these hinge points. At each hinge position, there is a CFRP fitting attached to the rear spar. Each CFRP fitting has two lugs, one on the left and one on the right. The two front arms of each V-shaped metal hinge arm fit into these lugs on the rear of the VTP spar. Figure2.Schematic of hinge arm details The hinge arms are attached to the CFRP fittings with spherical bearings, so they are free to pivot up and down. The rear of each hinge arm contains a hinge point for the attachment of the rudder. The hinge arm at hinge position4 is supported in the vertical direction by a metal structural tube referred to as the z-strut. All the vertical loads from the rudder are transferred to the VTP through the z-strut. Rudder movement is controlled by three hydraulic actuators located inside the VTP at hinge positions2, 3,and4. The forward ends of the actuators are attached to CFRPfittings on the rear spar of the VTP, and the aft ends are attached to aluminum alloy fittings on the front spar of the rudder. 1.5.4 Rudder Information 1.5.4.1 General The occurrence rudder, serial number 1331, was of the part number seriesA55471500, which is in use on earlier production A310, A300-600, A330,and A340aircraft. It was the same rudder that had been originally installed on the occurrence aircraft at the time of manufacture in1991. This rudder was one of the first in a batch of five rudders whose side panels were manufactured by the company Soko in Mostar, former Yugoslavia. The side panels were shipped from Soko to Airbus in Stade, Germany, where they were assembled into rudders. 1.5.4.2 Rudder Design The rudder consists of a single spar at the front, two side panels that fasten together at the trailing edge, and top and bottom closing ribs (see Figure3). The side panels are of single-piece construction and do not include any design features to mechanically arrest the growth of disbond damage. Each side panel is a sandwich composite constructed of a non-metallic Nomex aramid-based honeycomb core, with CFRP face sheets, and a glass fibre-reinforced plastic (GFRP) intermediate layer between the CFRP and the honeycomb as shown in Figure4. The GFRP intermediate layer does not have a structural purpose. It is simply a carrier for the resin that bonds the CFRP to the honeycomb. There is a layer of Tedlar on the interior face to provide a moisture barrier, and a layer of film adhesive (AF126) on the exterior face to provide aerodynamic smoothness. The density and thickness of the honeycomb and the number of face sheets vary with location because they are designed to react to applicable loads. Figure3.Schematic of the rudder Different pieces of honeycomb are bonded together along their side edges by a splice bonding adhesive. This same adhesive is also used to bond the side edges of the honeycomb to the z-section. The forward and bottom edges of the side panels are made with a pre-cured CFRP z-section. The side panels are fastened to the spar and ribs using blind mechanical fasteners. There are three aluminum lightning protection plates (LPPs) running chordwise on each side panel. To avoid galvanic reaction between these metal plates and the CFRP, there is an intermediate insulating layer of GFRP. There is a single spar, located along the front edge of the rudder and running the entire length of the rudder. The spar is a sandwich composite constructed of a Nomex honeycomb core with CFRP face sheets. There are seven lightening holes distributed along the length of the spar. Figure4.Rudder side panel construction There are only two ribs within the rudder. Rib0 is the closing rib at the bottom of the rudder and is a sandwich composite constructed of a Nomex honeycomb core with CFRP face sheets. Rib54a, constructed of aluminum, is the closing rib at the top of the rudder. The leading edge fairing of the rudder is divided into multiple sections along its length, each constructed of sandwich composite (see Figure4). The leading edge fairing sections are fastened to the side panel z-sections with threaded fasteners. There is an aluminum alloy strip along this row of fasteners as part of the lightning-protection system. Attached to the z-section at the bottom of each side panel is a rubber weatherstrip that covers the gap between the bottom of the rudder and the top of the tail cone. The weatherstrip is attached with threaded fasteners, and a metal strip is used as a washer plate along this row of fasteners. The side panels attach together at the rear of the rudder by a row of mechanical fasteners running parallel to the trailing edge, roughly 30cm ahead of the trailing edge. A metal protective strip runs down the entire length of the rudder trailing edge, which is also attached using mechanical fasteners. There are three hoisting points on each side panel. There are seven hinge positions, numbered 1through7, from bottom to top. Figure5 shows the design details at these hinge points. At each hinge position, aluminum alloy fittings are attached to solid GFRP blocks integrated locally into the side panels and to the spar web by mechanical fasteners. The core of the spar web, where the fasteners pass through, is filled by core filler and reinforced by an aluminum backing plate. The three control actuators attach to the rudder at hinge positions2, 3,and4. The metal hinge fittings at these locations have two lugs, one to act as the hinge point, and one to attach to a hydraulic actuator. Figure5.Schematic of rudder hinge fitting details 1.5.5 Rudder Manufacturing Method The rudder side panels, rudder spar, and rib0 are manufactured and cured separately and then assembled with mechanical fasteners into a rudder. Each side panel is assembled in a mold, with the exterior face on the bottom against the face of the mold. During curing, the manufacturing process results in the lower (outer) skin having a stronger bond. Although both bonds exceed design requirements, the inner skin bond does so by a smaller margin. The three LPPs are integrally manufactured and co-cured with the side panel. 1.5.6 Rudder Manufacturing Records Some manufacturing records for the side panels of the occurrence rudder were lost when the factory was bombed during the Yugoslavian war. Manufacturing records available at Airbus in Stade, Germany, and Toulouse, France, were reviewed for the occurrence rudder. This review found that non-conformities were detected by the quality assurance system, corrective actions were defined, rework was conducted, and the final product was inspected and released as airworthy. These non-conformities included such items as the position of hoisting points, the resistance of the anti-static paint, and various splice bond, skin and core filler re-works. The quality assurance of the Soko components was always under the responsibility of Airbus. The manufacturing records indicated that the rudder was in an airworthy condition at final assembly. 1.5.7 Rudder Modification Status The following is the modification status of the occurrence rudder: Modification 5844 (Glass Intermediate Layer). The occurrence rudder was a post-modification5844 (Service Bulletin [SB] A310-55-2012) design, which incorporated a GFRPlayer between the honeycomb and the CFRP skin, rather than aramid fibre-reinforced plastic (AFRP) as used in earlier design. Modification 8408 (Change in Honeycomb Size). The occurrence rudder was a post modification 8408configuration, which incorporated increased density honeycomb at certain locations. Modification 8827 (Change in Spar Construction). The occurrence rudder was pre modification8827, meaning its spar had the earlier design Nomex honeycomb/CFRP sandwich spar, rather than the solid CFRP spar of later design. Modification 5185 (Single-Piece Side Panels). The occurrence rudder was post-serial 1035, which means that the side panels were each constructed as a single panel. Earlier side panels were constructed of two parts, top and bottom, with a chordwise joint. Modification SRM (structural repair manual) 55-41-12 (Reinforcing Bolts in GFRP Blocks). The occurrence rudder had received modification SRM 55-41-12, Paragraph27, during manufacture. This modification added reinforcing bolts through the GFRP blocks at the hinge point level. 1.5.8 Rudder Control System 1.5.8.1 Rudder Control System Components The following is a descriptive list of the Airbus A310 rudder control system components: The rudder pedals, the rudder trim actuator, the two YD actuators, and the autopilot yaw actuator (APYA), which command the rudder to move. The push rods, the bell cranks, and the tension regulator and cables, also referred to as linkage, which transmit rudder commands. The three servo-controls - upper, middle, and lower - which operate the rudder. (The maximum rudder actuation rate with no load is 605 per second. The maximum rudder deflection is 30 either left or right.) The differential unit, a mechanical device, which sends a command to the rudder servo-controls. This unit sums the pilot or the autopilot input and the YD input. The two rudder travel limiter (RTL) systems, which provide a variable stop, limiting the travel of the rudder mechanical linkage downstream of the differential unit, and thus the input to the three servo-controls as the airspeed increases. The transmitter, located on the fin at rib1 and connected to the rudder with a rod attached to fitting No.1, which indicates the rudder surface position to the appropriate ECAM display unit. 1.5.8.2 Rudder Control System Operation The YD actuators are electro-hydraulic mechanisms that operate the YD system. The YD system has three functions: Dutch roll damper; turn coordinator; and yaw compensator during an engine failure on take-off or go-around. The YD commands are limited by software in the flight augmentation computers to a maximum of 39 of rudder movement per second. The maximum allowable displacement of the rudder by the YD is 10 at indicated airspeeds up to 165knots. The maximum allowable displacement at indicated airspeeds greater than 165knots is determined by a formula (10x(165/knotsindicated airspeed [KIAS])2). As the aircraft was flying at an indicated airspeed of 270knots at the time of the occurrence, the maximum displacement of the rudder by the YD was of 3.7. The YDand the rudder pedals are not linked, so YDinputs do not result in pedal motion. Rudder pedal and YDcommands are restricted to the limits imposed by the RTLsystem. Rudder position is determined by the sum of the pilot or autopilot input and the YDcommands limited by the travel limitation unit. The APYA, which produces yaw autopilot commands, is a single unit that houses two electro-hydraulic actuators, each controlled by a flight control computer (FCC). The APYA has an output lever that is connected through a torque limiter to the main bell crank. The torque limiter allows a pilot to override autopilot output by applying about 65decanewtons (daN) more than the rudder pedal feel forces. Autopilot yaw control commands are limited by software in the FCC to a maximum of 34 of rudder per second. The APYA and the rudder pedals are rigidly linked; therefore, autopilot yaw input results in pedal motion. The RTL system reduces the maximum allowable rudder deflection as airspeed increases. The limitation is such that the maximum deflection that can be achieved by the rudder remains lower than the deflection that would induce limit loads on the structure throughout the flight envelope. 1.5.8.3 Dutch Roll Description The Airplane Upset Recovery Training Aid4 describes the Dutch roll as follows: Static directional stability is a measure of the tendency of an airplane to weathervane into the free stream air mass. The vertical fin and distribution of flat plate area aft of the CG [centre of gravity] tend to reduce sideslip and add to good directional stability. All conventional airplanes require positive static directional stability. In simple terms, an airplane with good directional stability always wants to point directly into the relative wind - zero sideslip. As directional stability increases, the speed at which the aircraft returns to zero sideslip after being disturbed increases (higher frequency). In order to minimize overshoots in sideslip, the damping in the directional axis must be increased as the directional stability is increased. An undesirable characteristic can develop when the directional damping is not adequate enough to prevent overshoots in sideslip. A phenomenon known as Dutch roll (based on the similarity with the motions of high-speed ice skaters) can occur. A Dutch roll occurs when yaw rates produce sideslips, which produce roll rates. If the sideslips are not adequately damped, the aircraft nose will swing back and forth with respect to the relative wind, and the aircraft will roll right and left due to the dihedral effect (the wingsweep results in asymmetric lift, depending on the relative wind). Airplanes designed to fly at higher Mach numbers have more wingsweep to control the critical Mach number (the speed at which shock waves begin to form on the wing). As wingsweep increases, the dihedral effect increases, and if the airplane is not adequately damped in the directional axis, a Dutch roll might occur if the airplane is upset directionally. Yaw dampers were designed to minimize yaw rates, which result in sideslip rates, and are very effective in modern transports in damping the Dutch roll. However, some transport airplanes have a neutral or slightly divergent Dutch roll if the yaw damper is off or inoperative.5 Conventional airplanes exhibit more of a Dutch roll tendency at higher altitude (less damping) and higher speed (more directional stability). Therefore, if a pilot encounters a Dutch roll condition, every effort should be made to slow down and go down. With a properly functioning yaw damper, Dutch rolls will not occur in modern transport aircraft. Transport airplanes are certificated to demonstrate positively damped Dutch roll oscillations. The rudder should not be used to complement the yaw damper system. If the yaw damper system is inoperative, the rudder should not be used to dampen Dutch roll. 1.5.8.4 Dutch Roll Recovery Training During Air Transat initial training, pilots are exposed to Dutch roll recovery. The exercise is conducted with YDsengaged to demonstrate the automatic damping, and with the YDsdisengaged to practice the recovery technique and to demonstrate the natural damping. During the exercise, at the request of the pilot flying, the pilot not flying rapidly applies rudder until 40 of bank is achieved and then releases the rudder pedal. The rudder should not be used during recovery and the rudder control should remain in the neutral position. Transferring fuel forward will improve Dutch roll characteristics, and flying at or below FL310 will improve aircraft directional stability. 1.5.8.5 On-Board Documentation The A310 quick reference handbook (QRH) does not include procedures for abnormal flight conditions related to Dutch roll. However, the expanded checklist in the Flight Crew Operating Manual provides information to control Dutch roll in case of a yaw damper fault. A yaw damper fault was not the problem in this event. 1.5.9 Certification Information 1.5.9.1 Type Certificate This model of aircraft is covered by Transport Canada type certificate A-151. The data sheet provides the following information applicable to this occurrence: maximum operating speed: 340KIAS maximum operating Mach: 0.84 flight load factor with flaps up: -1.0to+2.5 1.5.9.2 Rudder Certification Tests The manufacturer conducted the following structural and flutter tests during the original certification of the rudder: 1.5.10 Inspection Schedule 1.5.10.1 Scheduled Inspection Cycle The scheduled aircraft inspection cycle is as follows: Note: Aircraft utilization is approximately 300hours per month (3600hours per year). 1.5.10.2 Scheduled Rudder Inspections The rudder is inspected during the following inspections: 1.5.10.3 Recently Completed Inspections The most recently completed major inspections before the occurrence were the following: 1.5.10.4 Rudder Damage Structural Repair Manual Limits Chapter 55-41-00, Figure105, of the structural repair manual (SRM) specifies that damage to the rudder side panels of the type impact and delamination without visible cracks or holes is to be repaired according to the following requirements: below 1000 mm2: allowable damage 1000 to 10 000 mm2: monitor damage and repair if it grows 10 000 to 40 000 mm2: monitor damage and repair within 2500 hours in accordance with the SRM above 40 000 mm2: repair immediately and refer to manufacturer6 1.5.11 Maintenance Actions 1.5.11.1 General All inspection and maintenance work reports were analyzed from the date of the aircraft's first flight in September1991 until the time of the occurrence. All records of structural repairs were examined, including all maintenance activities reported for components of the rudder control surface and system components, as well as special inspections. The investigation determined that the aircraft was maintained in airworthy condition in accordance with the Transport Canada (TC)-approved maintenance program. Significant rudder-related maintenance actions are described below. 1.5.11.2 Rudder Synchronization Check There is a requirement every 1300flight hours to conduct a rudder synchronization check as specified in AirbusSB A310-27-2082. This inspection requires the technicians to access the area at the base of the rudder. Although it does not include a structural inspection of the rudder, any significant external damage would be visible. This inspection had been carried out concurrently with the A-11 inspection on 01March2005, five days before the occurrence. No abnormalities were reported. 1.5.11.3 Lightning Protection Plate Replacement On 20 May 2004, less than one year before the occurrence and during the aircraft 2-C inspection, the rudder lower right-side LPP was found to be corroded in the aft attachment area. It was subsequently replaced, and tap tests7 of the affected area following the replacement showed no indications of inadequate bonding. Because this was one of the few rudder maintenance activities that were recorded, the complete replacement process of the LPPwas investigated. No anomalies were found that could have contributed to the occurrence. 1.5.11.4 Lightning Strike Repair On 12 August 1997, during the aircraft 4-C inspection, a non-routine inspection card was raised to address suspected lightning strike damage. The defect was written as upper corner of rudder, lightning strike mark, and the corrective action was written as rudder upper corner lightning strike area repaired in accordance with SRM51-73-10. This was a minor repair within SRM limits; the manufacturer was not advised. No photos or other records of the damage were available. This damage occurred more than seven years before the occurrence, and the aircraft was subject to all regular inspections in the intervening time. 1.5.11.5 Miscellaneous Rudder Servo-Controls Maintenance In December 1999, the number 7rudder hinge arm was found to have excessive play and it was repaired. In May2004, the rudder servos were modified according to SBA310-27-2091. 1.5.11.6 Maintenance Facilities Inspection of the operator maintenance base facility in Montral showed no indication that the aircraft rudder suffered an impact against crew lifting devices, other devices on the ramp, or hangar door frame. The investigation also determined that the tail of the aircraft could not have been affected by the heating or lighting systems in place or at the previous location of the company in Mirabel, Quebec. Transportation Safety Board of Canada - AVIATION REPORTS - 2005 - A05F0047 Transportation Safety Board of Canada Common menu bar links Fran�ais Home Contact Us Help Search canada.gc.ca REPORTS AVIATION 2005 A05F0047 Institutional links Main Links TSB Home Proactive Disclosure Marine Pipeline Rail Air Air Investigation Reports Recommendations and Assessments of Responses Board Concerns Air Statistics Reporting an Air Occurrence Air Investigation Reports Recommendations and Assessments of Responses Board Concerns Air Statistics Reporting an Air Occurrence 1.6 Meteorological Information The reported weather at the time of departure from Varadero (0600) was as follows: winds variable at two knots, visibility 8000m, few clouds (less than 2/8sky coverage) at 1800feet above ground level (agl), temperature 14C, dew point 12C, altimeter setting 1021millibars. The weather at Varadero at the time of landing (0800) was reported as follows: winds variable at two knots, visibility 7000m, few clouds at 1800feetagl, temperature 12C, dew point 11C, altimeter setting 1020millibars. At the time of the occurrence, the flight crew was in night visual flight conditions, and no turbulence was reported. 1.7 Aids to Navigation There were no reported problems with navigational aids. 1.8 Communications 1.8.1 Air Traffic Control TSC961 levelled off at FL 350 at 0701. As a result of the in-flight problem, TSC961 climbed nearly 1000feet, but there was no other traffic in the area; this altitude incursion did not result in a loss of separation. TSC961 was initially being guided for an approach in Fort Lauderdale, but the aircraft subsequently returned to Varadero. The crew was in contact with the controllers of four separate ATC sectors between the time of the occurrence and landing at Varadero. An emergency was not declared. 1.8.2 Crew/Company Communications At 0717, a phone patch was initiated with Air Transat dispatch in Montral through New York aeronautical radio incorporated (ARINC) using their high frequency radio. The flight problem was discussed with dispatch and maintenance. 1.8.3Communication Between the Flight Deck and the Flight Attendants After hearing the abnormal loud noise, the FD contacted the flight deck via the interphone. The flight crew was unable to respond at the time because of the control situation. Shortly thereafter, as per the company's prescribed abnormal/emergency communication procedure, the captain called the FDand provided the TESTRA briefing: T - Type of problem: autopilot not responding, flight diverting to Fort Lauderdale E - Evacuation (land or ditch): no evacuation S - Signals (standard or alternate): standard signals T - Time available before landing: 10minutes R - Relocation of passengers: not necessary A - Announcement to passengers done by (captain or FD): captain The captain did not ask the FD for a briefing with respect to the cabin environment and none was provided. In abnormal and emergency situations, it is neither the flight crew procedure nor practice to ask the FD if he/she has information to provide. It is assumed that any information that may assist in decision making will automatically be provided. Air Transat's procedure for communicating in abnormal situations calls for flight crew to ask if there are any questions following the TESTRA briefing, which they did. None of the FAs that were in the area of the aft galley contacted the FD or the flight crew to provide information in reference to the abnormal events encountered because they assumed that the flight crew and the FD were aware of the severity of what was felt in the back. In accordance with the applicable regulations and standards and as per the operator's approved training program, all crew members, pilots and FAs had received training with respect to crew communication. As well, they attended crew resource management training, which also addresses crew communications. Such training is provided during initial and annual training. During annual training, FAs and pilots also participate in joint crew communication training sessions during which communication skills and procedures are reviewed during simulated emergency situations. For initial FA training, the prescribed communication training objective is to teach the importance of, and the procedures for, effective communication in normal, abnormal, and emergency situations. Emphasis is placed on the responsibility of FAs to provide complete and accurate information to the pilot-in-command to assist in decision making; the potential hazards to flight safety if communication is not effective; and the consequence of poor communication in aviation occurrences. FAs are taught that they must communicate any on-board safety concerns they may have witnessed or that may have been communicated to them by passengers. When communicating safety concerns during normal or abnormal operations, FAs are to adhere to the line of authority when possible. However, if FAs notice an emergency situation developing, including unusual noises, they must contact the flight crew immediately via the interphone, stating their position and the nature of the problem. Training stresses that FAs should never assume that the flight crew is aware of everything that is happening. When information is not communicated, its potential value to flight safety is lost. There are procedures that set out the requirement for and the manner in which the FD must provide information to the FAs in abnormal and emergency situations. However, no such procedure or guideline was identified with respect to the FD collecting information from the FAs. As well, there is no requirement for the FDto provide flight crew with a structured briefing regarding the cabin environment in those situations. 1.9 Aerodrome Information TSC961 used Runway 06 at Varadero/Juan Gualberto Gmez International Airport (MUVR), Cuba, for the initial arrival, departure, and the subsequent return that night. Runway06 is 11490feet long and 148feet wide, with an asphalt surface, and is served by an instrument landing system. Air Transat had maintenance personnel on site at the airport. The Fort Lauderdale/Hollywood International Airport (KFLL), Florida, has a set of parallel runways and a crossing runway. TSC961 was being guided to Runway27R, which is 9000feet long and 150feet wide, with an asphalt surface, and is served by an instrument landing system. Air Transat had maintenance personnel available at KFLL, but customs services were not available at night. The Miami International Airport (KMIA), Miami, Florida, has four runways: 08/26L, 08/26R, 09/27 and 12/30. Runways12, 08R,09, 26Land 27are equipped with an instrument landing system. Air Transat did not have maintenance personnel on site in Miami. The Aircraft Rescue and Fire Fighting category of the three airports that could potentially have received TSC961 on the night of the incident exceeded the minimum response requirement for rescue and firefighting services for an aircraft the size of an AirbusA310. 1.10 Flight Recorders 1.10.1 Digital Flight Data Recorder The aircraft was fitted with a Honeywell/Sundstrand model universal flight data recorder (UFDR), part number 980-4100-DXUN, serial number10623. The recorder used an eight-track Mylar tape. The recording system consisted of a data frame of 64words per second, recording over 300parameters, with a minimum capacity of 25hours. The digital flight data recorder (DFDR) was received in very good condition. The recorder was disassembled and the tape was removed from the crash-protected memory cartridge for playback on an eight-track reel-to-reel instrumentation recorder at slower speed. A total of 25.3hours of data were recovered from the recorder. 1.10.2 Cockpit Voice Recorder The cockpit voice recorder (CVR) on the aircraft was a Loral Fairchild model A100-A, part number 93-A100-80, serial number60662, and was received in very good condition. The recorder contained four 30-minute audio tracks. Tracks1 and 2contained the radio channels of the captain and co-pilot, track3 was the cockpit area microphone channel, and track4 contained public address/interphone and radio communications. The quality of the recording was good. The aircraft flew for 1hour 17minutes after the loss of the rudder. The CVR audio of the rudder-loss event was overwritten, resulting in the loss of information, including the noises heard in the cockpit during the rudder failure. The CVR recording started with the aircraft en route to Varadero, approximately 15 minutes before landing. The last 15minutes were recorded on the ground in Varadero; the crew had not disabled the recorders. As a result of the TSB investigation into the Swissair Flight111 accident in Nova Scotia, the Board, in1999, made two recommendations that CVRs installed on aircraft be required to have a recording capacity of at least two hours (A99-01 and A99-02). As a result, aircraft manufactured after 31December2002 must retain information recorded during the last two hours of aircraft operation. Aircraft manufactured before this date, however, continue to require CVRs with a minimum of 30-minute recording capacity. There was no company procedure describing how to disable the recorders after landing. Current requirements in Canada are set out in TC's Aeronautical Information Manual (AIM) under General Information, Section3.0, Transportation Safety Board of Canada, Subsection3.4.3, Protection of Occurrence Sites, Aircraft, Components and Documentation, which states in part Where a reportable incident occurs, the pilot-in-command, operator, owner and any crew member of the aircraft involved shall, as far as possible, preserve and protect: the flight data recorders and the information recordedthereon... The AIM is consistent with the Transportation Safety Board Regulations, Section9(1), Preservation of Evidence Respecting Reportable Accidents and Incidents. 1.10.3 Direct Access Recorder On the aircraft, there is a direct access recorder (DAR) with an optical disk device having a storage capacity of 128megabytes. The data frame had a configuration of 128 words per second, recording approximately 127parameters, identical to that of the DFDR. Both the DAR and DFDR recorded flight data from identical sources; however, the recorded samples were not identical due to differing sample times. Data acquisition for both DAR and DFDR is handled by the digital flight data acquisition monitoring unit. The unit, manufactured by SAGEM, combines both the digital flight data acquisition unit function for the DFDR and the data management unit function for the DAR, feeding data to both recorders. The DAR optical disk was not originally requested by the TSB. Arrangements were subsequently made to transfer all applicable DARdata to the TSB. A total of 977hours (not continuous) of DAR data applicable to the incident aircraft, including the incident flight, were obtained from Air Transat. The DAR data were scanned for possible airborne and ground events. From the DAR data available, there were no significant events recorded that indicated lateral acceleration excursions, severe turbulence, or rudder doublets.8 Similarly, there were no significant ground events recorded that might indicate an impact to the rudder. 1.10.4 Data Sampling Rates The DFDR and DAR data were manually time-synchronized and the data showed good correlation, with the exception of the lateral acceleration data for approximately two seconds at the start of the rudder-loss event (see AppendixA). The differing data were the result of a highly dynamic event. Both the DFDR and DAR sampled lateral acceleration at a rate of 4Hz. At this rate, it was not possible to identify any lateral acceleration frequencies above 2Hz.9 The determination of the specific frequencies involved in the rudder-loss event was not possible due to these low sampling rates of the recorded lateral accelerations. Under current regulations (Standard625, Schedule3, Aeroplane Digital Flight Data Recorder (DFDR) Specifications, of the Canadian Aviation Regulations [CARs], which are harmonized with Part121, AppendixM, of the United States Federal Aviation Regulations), the sampling intervals for lateral and longitudinal acceleration are 4Hz and vertical acceleration is 8Hz. These rates meet the performance standards as recommended by the European Organisation for Civil Aviation Equipment (EUROCAE) minimum operational performance specifications (MOPS) for Crash Protected Airborne Recorder Systems(ED112). 1.10.5 Filtering of Recorded Data The control surface position data recorded on the DFDR and DAR, including rudder position, were filtered by the system data analogue converter before recording. The filtered data are fed to the cockpit instrument displays, and the filtering process is designed to smooth out the data to remove unwanted spikes and prevent erratic indications. This same information is also recorded on the DFDR, and due to sampling and filtering, does not accurately represent the true control surface positions under dynamic conditions. Since the rudder loss on TSC961 was a dynamic event, critical information concerning the flight controls was potentially lost due to filtering. 1.10.6 Summary of Flight Recorder Data At the time of the occurrence, the aircraft was in steady level flight at approximately 35000feet and 270knots (Mach0.795), with no significant control movements or turbulence. The aircraft had not exceeded any load or airspeed boundaries of its structural design envelope. Approximately 50 seconds after levelling off at FL350, a dynamic oscillation in lateral acceleration occurred, lasting for approximately two seconds. This was the first indication in the DFDR/DAR data of the rudder-loss event. At the start of the oscillations, the lateral acceleration changed from +0.006g to -0.073g, indicative of a lateral force applied to the aircraft. Within one second of the dynamic oscillations in lateral acceleration, the heading decreased by 2 and the aircraft began to roll left from wings level. At the same time, the autopilot commanded aileron and spoiler deflections (right-hand spoilers5, 6and 7extended) for right roll. The recorded rudder position indicated movement to the right from 1.2 left of neutral (0 with the 1.2 bias removed) to approximately 0.3 left of neutral (0.9 right of neutral, with the 1.2 bias removed). A pitch increase from 2to 3 nose-up occurred, with a corresponding increase in vertical acceleration to+1.28g. A yawing/rolling oscillatory mode, consistent with Dutch roll, commenced within two seconds of the rudder-loss event, as the dynamic oscillations in lateral acceleration decreased. At this time, a slight increase in altitude was followed by a decrease in pitch (from 3 to 2 nose-up), and a reduction in engine thrust (N1 decreased from 90to 77percent). A gradual reduction in speed followed. The roll attitude reached 6 left-wing-low and then reversed direction. Approximately six seconds into the event, the recorded rudder position reached 6.2 right of neutral (approximately 7.4 right, with the bias removed). At the speed of 270KIAS, the recorded rudder deflection was beyond the YDauthority of3.7. Approximately seven seconds into the event, the No.2 autopilot was disengaged, followed immediately by disengagement of the auto thrust mode (manual throttle armed). The aircraft began to climb above FL350 approximately 18seconds into the event. With the autopilot disengaged, the oscillatory motion decreased in amplitude as the aircraft climbed through 35200feet, and as airspeed decreased through 256KIAS. The speed decreased to a minimum of 248KIAS. The altitude briefly peaked at 35900feet and the aircraft then began to descend. Autopilot No.1 command mode was briefly engaged as the aircraft descended through 35000feet. With autopilot engagement, the yawing/rolling oscillatory motion increased in amplitude. After approximately 17seconds, the autopilot was disengaged and the oscillations subsequently began to decrease in amplitude. As the aircraft descended through 27900feet and the speed decreased through 258KIAS, the oscillatory motion ceased. 1.11 Wreckage and Impact Information 1.11.1 Miscellaneous Damage Some ceiling panels inside the passenger cabin had partially popped out of position. The displacement was very slight and did not impede passenger movement. The interior of the fuselage compartment behind the aft pressure bulkhead was inspected; there were no indications that the loads and vibrations associated with the rudder separation had caused any structural damage. The aircraft exterior was inspected, and there were no missing panels or structural components that may have come loose and struck the rudder. Apparent scrapes on the fuselage side, directed upward toward the tail, were determined to be poorly adhered, peeling paint and were not the result of foreign object damage (FOD). There was also blue-colour paint transfer visible on the left side of the tail cone, just aft of the rudder, probably the result of a piece of the rudder striking the tail cone during separation. There was a series of puncture holes in the fuselage skin on the upper right side near the base of theVTP. These punctures were the result of the impact, during rudder breakup, of the mechanical fasteners that attach the rudder leading edge fairing to the rudder. 1.11.2 Vertical Tail Plane Damage 1.11.2.1 General Photo2 shows the VTP and its rudder residuals being removed from the aircraft. The damage to the VTP trailing edge panels was generally limited to minor paint chipping. There was no damage suggesting that the rudder had been battered due to extreme travel from side to side. Photo2.Removal of the VTP and a view of the position of the main attachment fittings 1.11.2.2 Main Attachment Fittings The VTP main attachment fittings were examined. On the fuselage side, these fittings are constructed of metal. Following the occurrence, they were subjected to visual and NDI, and no damage was found. The six CFRP main attachment fittings on the VTPside were subjected to ultrasonic NDI. Delamination damage was found in the two aft main attachment fittings. When the VTP is loaded in lateral bending, the two rear main attachment fittings are the most severely loaded. A full-scale test of the VTP conducted during the initial certification involved fatigue testing for three lifetimes followed by static testing, where the specimen main attachment fittings failed at over 1.9times the limit load. In addition, three further static load tests conducted during an earlier investigation resulted in attachment fitting failures at greater than 1.8times the limit load. It is noted that design ultimate load corresponds to 1.5times the limit load and that, in order to meet certification requirements, a structure must withstand design ultimate load for at least three seconds. These tests demonstrated that the design exceeds certification load requirements. An analysis conducted in support of this occurrence investigation determined that, in order to cause the damage observed to the VTPmain attachment fittings, the load experienced during the occurrence exceeded the design ultimate lateral fin bending load. However, it was not possible to quantify the precise load value attained. A 3D finite element analysis was conducted and included details of the main attachment fittings delamination on the occurrence aircraft, as reported by the NDI. This analysis was validated by a test on a damaged rear attachment fitting. It indicated that, when ultimate loads were applied to the model, strain levels varied only slightly from those of the undamaged model and were well below the levels required to cause a fracture of the main attachment fittings. Therefore, the delamination had a minimal effect on the strength and stiffness of the main attachment fittings. Consequently, after the rudder-separation event, the aircraft was not in danger of losing the VTPduring the flight either through loss of static strength or loss of stiffness. 1.11.2.3 Hinge Arms Laboratory examination of hinge arm 1 found the right bolt under tolerance at the attachment of the hinge arm to the VTP. The fitting on the aft face of the VTP showed no visible signs of damage, such as cracks in the paint or sealant, but ultrasonic NDI found delamination around the mechanical fasteners. The forward ends of the hinge arms did not show any indication of upward travel as found at hinge arm5. The rudder residuals were still attached. All three electrical grounding wires, two on VTP side and one on rudder side, were fastened with no indication of burning. There was no sign of any extreme side-to-side travel as with hinge arms5 and6. There were impact marks on the rudder leading edge fairing caused by the hinge arms. This damage was restricted to the centre region, and the damage lines up with the hinge arms when the rudder is not deflected. At the hinge arm 2, 3, and 4 positions, the hinge arms are co-located with the hydraulic actuators. De-synchronization of the hydraulic actuators can result in force-fighting between them, which could lead to damage at their attachment points. Visual and NDIof the attachments did not find any sign of damage to the structure or to the mechanical fasteners. There was no indication of any structural damage that would degrade the stiffness of the actuator attachment. All the electrical grounding wires were fastened with no sign of burning. There was no indication of any extreme rudder travel as was the case at hinge arms5 and6. The z-strut located above hinge position4 is designed to transfer vertical loads from the rudder into theVTP. The attachment fitting at the upper end of the z-strut showed no visual sign of damage, such as cracking of the paint or sealant, but there were paint chips on its top surface. This damage was probably caused by the upper end of the rudder separating and dropping vertically. At the hinge arm5 position, the metal hinge arms were still securely fastened to the fitting on the aft face of the VTP rear spar, and the fitting showed no visible signs of damage, such as cracks in the paint or in the sealant. The forward ends of the hinge arms showed damage consistent with the hinge arms having moved upwards. The rudder-side hinge fitting was still attached along with a short section of the rudder spar, roughly 23cm high by 26cm wide. Ultrasonic NDI found no delamination around the mechanical fasteners that attach the CFRP fitting to the VTP rear spar, but the shim layer used to adjust the thickness of the CFRP fitting was mostly disbonded. All the electrical grounding wires were fastened with no sign of burning. The rudder-side bonding cable was badly frayed at the forward end, roughly at the position of the hinge bolt. The hinge arm was damaged by extreme side-to-side travel of the rudder hinge fitting, reaching nearly 90 deflection in each direction. Manufacturer's drawings indicate that, at a rudder deflection of 45, the rudder leading edge fairing cut-out strikes the hinge arm. At 60, the rudder-side hinge fitting strikes the hinge arm. At 84, the rudder side panel strikes the VTP trailing edge panel. There was no damage to the hinge arm where the leading edge fairing would have struck as the rudder passed through 45 of travel, and no damage to the VTP trailing edge where the rudder would have struck while passing through 84 of travel. The absence of such damage indicated that the damage from the extreme side-to-side travel occurred after detachment of the rudder and would have started as the rudder passed through 60 of travel, progressing until the rudder reached about 90 of travel. At the hinge arm 6 position, the metal hinge arms were still securely fastened to the fitting on the aft face of theVTP. The fitting showed no visible signs of damage. The forward ends of the hinge arms did not show any sign of upwards travel. The rudder-side hinge fitting was still attached along with a short section of the rudder spar, roughly 15cm high by 22cm wide. Ultrasonic NDIfound delamination around the mechanical fasteners that attach the CFRP fitting to the VTPrear spar. All the electrical grounding wires were fastened, with no sign of burning. The bolt that attaches the left side of the hinge arm to the VTPwas nearly seized. The hinge arm had been damaged by extreme side-to-side travel of the rudder, where the rudder-side hinge fitting had struck the hinge arm, reaching nearly 90 deflection in each direction. The damage was less severe than that at hinge arm5. Manufacturer's drawings indicated that, at a rudder deflection of 43, the rudder leading edge fairing cut-out strikes the hinge arm. At 70, the rudder-side hinge fitting strikes the hinge arm. At 84, the rudder side panel strikes the VTPtrailing edge panel. There was no damage to the hinge arm where the leading edge fairing would have struck as the rudder passed through 43 of travel, and no damage to the VTP trailing edge where the rudder would have struck while passing through 84 of travel. The absence of such damage indicated that the damage from the extreme side-to-side travel occurred after detachment of the rudder; the damage would have started as the rudder passed through 70 of travel and would have progressed until the rudder had reached about 90of travel. At the hinge arm7 position, the VTP-side CFRP attachment fitting had fractured and separated. 1.11.3 Rudder Damage 1.11.3.1 General As will be discussed later in this report, subsequent analysis found that the rudder loss during flight was progressive, and by the time the aircraft landed, most of the rudder had separated from the aircraft. Photo3 shows the empennage after landing in Varadero. The separated pieces fell into the ocean and none were recovered. Rib0 remained attached, as did the length of rudder spar up to hinge point4. Asmall piece of rudder side panel from each side remained attached to the spar in the region between hinge points2 to4, and also in the corner where the spar meets rib0. The leading edge fairings between hinge points2 and4, and below hinge point1, were still attached. The leading edge fairing between hinge points1 and 2had separated and some pieces were found jammed between the rudder and the VTP. At hinge points5 and6, small pieces of the rudder spar remained attached to the hinge arm. At hinge point7, the VTP-side hinge bracket had fractured and separated, so none of the rudder remained. Photo3.Left-side view of VTP and rudder residuals 1.11.3.2 Detailed Description of Rudder Damage The front face of the rudder spar was cleaner at the hinge positions, consistent with what would be expected if the hinge areas had been cleaned for inspection. The aft face of the rudder spar was generally clean along its entire length, becoming slightly dirtier toward the bottom. There were drip stains oriented downwards originating at the lightening holes, consistent with normal in-service staining caused by dripping hydraulic fluid, corrosion inhibitor, or other fluids. There were dark stains observed on the interior of the side panels where the reinforcing bolts pass through the GFRP blocks at the hinge points. These stains originated at the bolts and progressed in a downward direction. The foils, which normally cover the lightening holes on the rudder spar, were missing, and the pattern of dirt around each lightening hole suggested that the foils had been removed for a considerable period before the occurrence. The top surface of rib0 was visibly dirty. There were no stains on the interior bottom of the rudder to suggest that fluid had been pooling in the bottom of the rudder. The fluid drain holes and drain paths at the bottom of the rudder were not plugged. There were no stains in the honeycomb cells to suggest the presence of trapped fluids; however, very little of the honeycomb remained for examination. Cross-section examination of the rudder exterior skin revealed 10layers of paint composed of primer, anti-static, filler, and topcoat. There was an accumulation of three paint re-sprays. It was calculated that the mass of the extra two re-sprays was approximately 19.3kg. The total mass of a rudder with the nominal paint system is approximately 190kg. The small amount of surviving rudder was examined for indications of contact with maintenance equipment, FOD, or damage by misuse. The only finding was a circular grinding mark on the exterior of the right rudder side panel. Cross-section examination determined that the grinding mark only extended down into the first few layers of paint, with no damage to the CFRPor discolouration due to heating. On each side of the rudder, there are three LPPsrunning chordwise. On the occurrence rudder, recent maintenance had involved the replacement of the lower right LPPin May2004. A short length of this LPPremained and its fractured end was bent forward. A section of the side panel at this LPPwas taken for subsequent laboratory analysis. The right side panel's outer face sheet exhibited many small multidirectional surface marks. There were similar marks on another aircraft (MSN600), whose rudder was inspected and found undamaged. A section cut through these marks on the occurrence rudder revealed that they were cracks that had originated in the paint, caused by excessive paint thickness. It was further found that, when a paint crack was parallel to the direction of the CFRP fibres, the crack could extend down into the CFRP resin matrix. These cracks were limited to the matrix and did not damage the fibres. The CFRP face sheets had separated from the honeycomb core and the separation had a different appearance depending on whether it was an interior or exterior face sheet. The interior face sheets had generally separated from the honeycomb very cleanly near the bond line. However, the exterior face sheets had separated from the honeycomb in a very jagged manner with separations occurring at different depths in the honeycomb. Microscopic examination of the inner skin separation found that they were mostly cohesive failures within the bond line through the meniscus.10 Since the honeycomb had been so badly damaged during the occurrence, it was not possible to distinguish damage to honeycomb cells that may have been caused by freezing of trapped water. At the actuator locations, the interior CFRP face sheets had separated into four plies. There were no significant gaps in the coverage of the splice bond adhesive at the edges of the honeycomb sheets. In regions where a separation occurred near a honeycomb splice bond, the separation tended to occur in the weaker density honeycomb, and not in the bond line. Exposed regions of honeycomb that were no longer supported by the CFRP had tended to split into many small chordwise fingers, each about 25to 50mmwide. The rudder spar had fractured just above the hydraulic actuator attachments. Examination of fractured fibres indicated that the spar separated in an up and aft direction. The metal strip along the z-section at the front edge of each side panel had also fractured at this location, and examination revealed that it was a ductile overload failure. Photo 1 shows that there was no significant amount of rudder side panel still attached between hinge positions1 and2. In this region, more honeycomb remained on the right side, but more inner skin remained on the left side. The joint between the side panels and the spar, which uses blind mechanical fasteners, had not failed and the fasteners were intact. Examination of the fractures at the joint between the front spar and the side panels revealed that the side panels or part of the side panels separated toward the outboard. Along the length of rudder spar between hinge points1 and2, the z-sections had fractured and separated along with the side panel on both sides. Since the leading edge fairing attaches to the z-sections, this explains why the leading edge fairing was missing in this region. The metal actuator attachment fittings at the hinge point2, 3,and 4positions did not show indications of damage, deformation, or looseness. The joint between the side panels and rib0, which uses blind mechanical fasteners, had not failed and the fasteners were intact. There was a wipe mark across the top of rib0, consistent with a fractured section of the left side panel moving towards the right and downwards. At the left side panel separation, more of the z-section had remained than on the right side. The fastener holes had been torn out towards the bottom, suggesting that the left side panel or part of the side panel separated from rib0 in a downwards or outwards direction. The left side panel also had compression damage, suggesting the inboard skin moved downwards during separation. A failure in the z-section remains suggests that the outboard skin moved outboard during separation. At the right side panel separation, a length of the z-section had fractured and separated. Marks were observed on the remaining CFRP edge and their spacing corresponded to the spacing of the missing mechanical fasteners. These marks suggest that the right side panel or part of the side panel separated in an upwards direction. Examination of the right side panel showed that it separated from rib0 in a tension flexion failure. The metal strips along the z-section had failed by overstress, a combination of tension and bending to the outside. There was a skin buckle on each side panel consistent with rib0 moving upwards. There was a crack at the tip of rib 0 whose orientation was consistent with rib0 twisting to the right. Examination of other rudders as part of the fleet inspections following the occurrence found side panel damage at the hoisting points and the trailing edge fasteners. Since none of these areas of the occurrence rudder were recovered, it was not possible to examine them. Furthermore, since the entire upper end of the rudder was not recovered, the area around the 1997lightning strike damage could not be examined. Only a short section of the rudder spar at hinge point5, roughly 23cm high by 26cm wide, remained attached. The lower surface of the spar section included the edge of a lightening hole. The rear reinforcement plate was still securely fastened to the spar and all its fasteners were still present and appeared undamaged. The separation between the honeycomb and the CFRP skin had generally occurred in the honeycomb, at varying depths and not along the honeycomb/CFRP bond line. On the front surface of the spar, the rudder-side hinge bracket had fractured. The fractured surface appeared typical of a tensile/bending overload failure with no indication of fatigue. Metallurgical analysis determined that the fittings were made of the correct aluminum alloy and temper. Only a short section of the rudder spar at hinge point6, roughly 15cm high by 22cm wide, remained attached. The lower surface of the spar section included the edge of a lightening hole. The rear reinforcement plate was still securely fastened to the spar, and all its fasteners were still present and appeared undamaged. The separation between the honeycomb and the CFRP skin had generally occurred in the honeycomb, at varying depths, and not along the honeycomb/CFRP bond line. On the front surface of the spar, the rudder-side hinge bracket had fractured. The fractured surface appeared typical of a tensile/bending overload failure with no indication of fatigue. Metallurgical analysis determined that the fittings were made of the correct aluminum alloy and temper. 1.11.4 Chemical Attack and Contamination The rudder residuals were examined to study the possibility that they had been contaminated and degraded by exposure to chemicals. The manufacturer provides a list of approved consumables, as well as procedures to follow for the approval of materials not on that list. No indication was found that unapproved consumables were being used by the operator. There is no in-service experience to suggest that there was a systemic problem with chemical attack by approved consumables. During the material qualification process at certification, extensive testing was conducted to understand the interaction between the materials and possible contaminants, including hydraulic fluid. However, the bond between the honeycomb and the CFRP face sheets was not included in these tests because it was in the interior structure and considered to be sealed from such exposure. A water and hydraulic fluid mixture may react under certain concentrations to form phosphoric acid, which can attack epoxy resin creating irreversible damage to the core/face sheet interface. Microscopic examination of the rudder of aircraft MSN 361, which was known to be contaminated by hydraulic fluid, revealed that hydraulic fluid had attacked the matrix of the GFRP layer adjacent to the honeycomb, weakening the bond, but not leading to a disbond. Based on service experience with the aircraft MSN361 and MSN 545rudders, the access path for hydraulic fluid into the sandwich structure is around the blind fasteners at the front and bottom edges of the side panels. Three methods were used to search for the presence of hydraulic fluid contamination: energy dispersion X-ray spectroscopy (EDX), X-ray photoelectron spectroscopy (XPS), and infrared (IR) spectroscopy. The rudder of aircraft MSN361, which was known to be contaminated by hydraulic fluid, was used to calibrate these three analysis methods. EDX testing of regions that were visibly stained by hydraulic fluid found roughly 2percent phosphorus content, and XPS testing found roughly 0.8percent phosphoric acid-ester content. The top surface of rib 0 of the occurrence aircraft was visibly dirty, and an area at the front near the spar was analyzed. EDX results indicated 0.4percent11 phosphorus, considerably lower than the 2percent associated with the visibly contaminated region of the rudder of aircraft MSN361. An area of inner skin (non-honeycomb side) from the left side panel front bottom corner was analyzed. EDXresults indicated less than 0.1percent phosphorus, considerably lower than values from the aircraft MSN361 rudder. An area of the inner skin (honeycomb side) from the left side panel front bottom corner was analyzed. EDXresults indicated 0.3percent phosphorus, and XPS results indicated 0.18percent phosphoric acid-ester, both considerably lower than values from the rudder of aircraft MSN361. An area of inner skin (honeycomb side) from the right side panel front bottom corner was analyzed. EDX results showed less than 0.1percent phosphorus and XPSresults indicated 0.07percent phosphoric acid-ester, both considerably lower than the values from the aircraft MSN361rudder. Since the suspected hydraulic fluid ingress path was around the blind fasteners, specimens were taken around blind fasteners on both side panels at the front spar and at rib0. Measurements were taken inside the sandwich structure at the inner face of the skin. EDXresults for phosphorus on interior surfaces were all below the 0.1percent detection limit. EDXresults on the external surfaces at rivet positions showed readings as high as 3.0percent. In addition, cross-section microscopic examination of the bond area did not reveal visual indication of chemical attack. Therefore, these results show the presence of hydraulic fluid contamination on exterior surfaces, but no indication of seepage into the structure. 1.11.5 System Inspection and Testing The inspection of the rudder system on the occurrence aircraft showed that the rudder control, in cruising flight at 270knots, would not have exceeded 7of travel per side; the RTLcontrol would have prevented it (RTLsystems do not only limit the pedal inputs, but also limit the sum of inputs from trim, pedals or APYA, and YD). The autopilot was active at the time of the occurrence. The YDwas also active (YDis active in manual flight also). The YDwas restricted to moving the rudder to no further than 3.7either side to compensate for the natural Dutch roll tendency of the aircraft. The last rudder servo-control synchronization check, performed by Air Transat maintenance on 01March2005, revealed that no anomalies and no adjustments were required. In Varadero, the synchronization check showed no movement between the neutral position of the three servo-controls; there was no force-fighting between servo-controls. Therefore, the synchronization between the servo-controls was within the Airbus aircraft maintenance manual (AMM) parameters before and after the event. The inspection and investigation of the aircraft flight control system and related subsystem components was performed by the investigation team in Varadero after the occurrence and revealed no anomalies. The rudder control system was checked and tested for proper operation in Varadero with no anomalies found. The rudder servo-controls and actuating spring rods were then removed, inspected, and laboratory tested, and no anomalies that would have affected the normal operation of the rudder system were found. In addition, all safety features that are part of the servo-controls and spring rods to ensure safe operations in case of servo-control malfunction were operational. The free play was measured from hinge point 1 to hinge point 6; one free-play measurement was out of tolerance on the hinge line bearing at hinge point2. In addition, 3out of 10VTP-side hinge arm bearings were partly seized but could still be rotated. Airbus specifies that the hinge arm bearing free play has no impact on the structural integrity of the rudder. Free play at the hinge arm bearings would result in detectable rudder vibration that will trigger a specific troubleshooting inspection process. No in-flight rudder vibrations had been reported. Operators are provided with some troubleshooting guidelines that list the most probable causes when vibrations are felt. However, the main cause of rudder vibration is play at the servo-control bearings, rather than at the hinge arms. The Airbus troubleshooting philosophy is such that, if there are no findings of free play at the servo-control bearings, or if they are replaced and the situation is not improved, the operator will contact Airbus for investigation. Airbus in-service experience has confirmed the relevancy of this approach. 1.11.6 High-Intensity Radiated Fields Investigation The possibility that high-intensity radiated fields (HIRF) interference could affect the normal in-flight operation of the rudder system was investigated. Any oscillation from the YDsystem at a frequency of 20Hz, representing the difference of frequency between the radar and rudder synchronization frequencies, will be attenuated by the YDactuator and the three servo-controls that would be acting as filters. A review of the theoretical rudder deflection when the YDsystem is subjected to HIRF, assuming susceptibility at 20Hz, led to the conclusion that the maximum rudder deflection would be less than 0.1. Therefore, the investigation determined that the effect of HIRFwould have a negligible impact on the rudder surface control. 1.11.7 Examination of Pre-Occurrence Photos Photographs of the aircraft taken before the occurrence showed curious visual features on the rudder. Photo4 shows an example of one of these features. It was taken 11days before the occurrence and shows light-coloured vertical lines on the left side of the rudder below the hydraulic actuators. There were also earlier photographs that showed arc-shaped lines on the left side panel just aft of the hydraulic actuators, and white spots on the trailing edge. These features were not present on the most recent photographs. Photo4.Pre-occurrence photograph of aircraft There was insufficient resolution in the photographs to conduct a photogrammetric analysis that would determine whether these vertical lines represented an out-of-plane deformation such as a disbond bubble. Since the vertical line features were observed on photographs taken on different days under different lighting conditions by different photographers, they were actual physical features on the rudder, and not simply reflections or dirt on the camera lens. The vertical line features first appeared in photographs starting in early 2003,and the aircraft was subject to all its regular inspections in the intervening time. Examination of other aircraft found that staining of the rudder near the hydraulic actuators was not unusual. Subsequent testing found that hydraulic fluid could dissolve the Air Transat tail decal material and analysis of a vertical streak on sister aircraft MSN600 found the streak to be composed of a mixture of hydraulic fluid and dissolved decal material. Transportation Safety Board of Canada - AVIATION REPORTS - 2005 - A05F0047 Transportation Safety Board of Canada AVIATION REPORTS - 2005 - A05F0047 Common menu bar links Fran�ais Home Contact Us Help Search canada.gc.ca REPORTS AVIATION 2005 A05F0047 Institutional links Main Links TSB Home Proactive Disclosure Marine Pipeline Rail Air Air Investigation Reports Recommendations and Assessments of Responses Board Concerns Air Statistics Reporting an Air Occurrence Air Investigation Reports Recommendations and Assessments of Responses Board Concerns Air Statistics Reporting an Air Occurrence AVIATION REPORTS - 2005 - A05F0047 The Transportation Safety Board of Canada (TSB) is investigating this occurrence for the purpose of advancing transportation safety. It is not the function of the Board to assign fault or determine civil or criminal liability. Because the investigation is ongoing, the information provided is subject to change as additional facts become available. The purpose of this communication is to update interested organizations and persons on the factual information gathered to date, to provide information regarding safety-related activities, and to provide information about further investigation activities. Ce point sur l'enqute est galement disponible en franais. Investigation Organization On 06 March 2005, Air Transat Flight961, an Airbus310-308, Canadian registration C-GPAT, serial number597, lost the major part of its rudder while in flight from Varadero, Cuba, to QubecCity, Canada. The flight returned to Varadero where an uneventful landing was carried out. The Transportation Safety Board of Canada (TSB) was notified of the accident at 11001 and responded by deploying two investigators from the Dorval, Canada, regional office and one investigator from the TSB Engineering Laboratory in Ottawa, Canada. Because the event occurred over international waters, Canada, as the State of Registry, is conducting the investigation. The investigation team is composed of the following five main groups: operational, air traffic control (ATC), human factor, technical, performance, and recorders group. Four subgroups under the technical group have been established; a system group, a structure and maintenance group, a maintenance records group, and a manufacturing group. The Bureau d'Enqutes et d'Analyses pour la Scurit de l'Aviation Civile (BEA) of France, the German Federal Bureau of Aircraft Accidents Investigation (BFU), and the National Transportation Safety Board (NTSB) of the United States assigned accredited representatives to participate in the investigation. Technical advisors from Airbus, Transport Canada, the Direction Gnrale de l'Aviation Civile (DGAC), the Federal Aviation Administration (FAA), the German Aerospace Center (DLR), and Air Transat are also participating and assisting in the investigation. Factual Information The A310-308, operated by Air Transat, was on a charter flight from Varadero, Cuba, to QubecCity, Canada, with a crew of 9 and 261passengers on board. While at an altitude of 35000feet, the flight crew heard a loud bang with simultaneous vibrations that lasted a few seconds. The aircraft entered a periodic rolling and yawing motion known as dutch roll that decreased as the aircraft descended to a lower altitude. Once the aircraft reached about 19000feet, the flight crew had no indication of any abnormalities from systems monitoring. The flight crew considered landing at Fort Lauderdale, Florida, but elected to return to Varadero where an uneventful landing was carried out. It is only once on the ground that the flight crew noted during a visual inspection that a major part of the rudder was missing. There were no fatalities. One flight attendant sustained minor injuries. The investigation team observed that only the lower rudder spar and the base rib of the rudder were remaining. Less than five per cent of the total rudder surface actually remained attached to the spar. The rudder is attached to the vertical fin through seven A-frame hinges, numbered one to seven, starting from the bottom. The remaining parts of the rudder were attached to the vertical fin's rear spar by the actuators and the four lower rudder hinges. Hinges five and six were were still in place on the fin spar, but only the attachment fittings of the rudder were attached to them. The rudder position sensor was still attached to the remaining piece of the rudder. Rudder hinge number seven was torn off from the fin spar. The panels that cover the rudder are made of carbon fibre reinforced plastic (CFRP). The panels were manufactured in 1991 by Soko in Mostar, former Yugoslavia. The rudder panels (serial number1331) were assembled at Airbus facilities in Stade, Germany, and then installed on the aircraft in 1992. The aircraft had accumulated 49224flight hours since manufactured in 1992. The flight data recorder (FDR), the cockpit voice recorder (CVR), and the digital AIDS (aircraft integrated data system) recorder (DAR) were sent to the TSB Engineering Laboratory for downloads of all data recorded to determine the sequence of events and the contributing factors of this event. The work is still in progress. On 19 March 2005, the vertical tailplane (VTP) and the rudder were transported from Cuba to Bremen, Germany, for further examination. The VTP, to which the rudder is attached, is bolted to the top of the fuselage by six attachment lugs. The VTP was subject to ultrasonic inspection, which revealed delamination damage to the two rear attachment lugs. Loads and aeroelastic models are being formulated to evaluate the noted damage. An elasticity laminate checker (ELCH) test on sample in-service rudders is also in progress to check rudder panels in depth, from the outer skin to the inner skin. This test will provide information on rudder skin and core damage over a sampling, ranging from 13-year-old rudders to more recent rudders. At this time, one test has been carried out on one of the selected rudders, and no discrepancies have been found. The rudder control systems were checked and tested in Varadero with no anomalies found. The three servo-controls that control rudder movement were inspected and tested at Goodrich facilities in Paris, France, during the second week of April. Rudder servo-control spring rods were also investigated in Airbus facilities in Hamburg, Germany, and no deficiencies were found. Maintenance and technical records of the aircraft are being reviewed by the maintenance and records group to determine if any past maintenance activities on the aircraft, or if any past reported operational events may have played a role in the detachment of the rudder. Safety Action Taken Following the event, a number of actions have been taken. On 17March 2005, Airbus produced an All Operator Telex (AOT) to verify the structural integrity of the rudder and its attachment by means of a one-time detailed visual inspection and tap test inspection as a precautionary measure. On 18March 2005, the Direction Gnrale de l'Aviation Civile (DGAC) of France issued an Emergency Airworthiness Directive (EAD) that includes mandatory actions and compliance times to perform inspection and apply corrective measures if necessary in accordance with the instructions specified in the Airbus AOT. On 28March 2005, the FAA issued a similar Airworthiness Directive (AD). All results and feedback from these mandatory inspections are being compiled by Airbus. Once validated safety deficiencies are identified during the course of an investigation, the Board can, at any time during the investigation, recommend action designed to reduce or eliminate such deficiencies from the transportation system. Investigation Plan There is still a considerable amount of work to be done to bring this investigation to a conclusion by the Board. In the following months, further ELCH tests will continue on other rudders of the defined samples to check rudder panels in depth, from outer to inner skin, and to measure rudder structural rigidity. The preparation of the draft report will take months to be completed with emphasis on the analysis of collected factual information gathered by the detailed examination of the failed rudder, the fin box lugs, the AOT and ELCH test results and any appropriate investigation work. When the investigation team's draft report is complete, it will be reviewed by the Investigation Branch Standards and Performance section, and approved by the Director, Air Investigations. The draft report will then be submitted to the Board for its approval and released as a confidential draft report to designated reviewers. The Board will consider the representations of the designated reviewers, amend the report if required, and issue the final investigation report. 1. All times are Coordinated Universal Time (eastern standard time plus five hours).